Bug 255956
| Summary: | [1c8922b0f08df135] stack-overflow | WebCore::RenderObject::repaintRectangle; WebCore::RenderObject::repaintRectangle; WebCore::RenderObject::repaintRectangle | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | JC Alvarado <joncarlo> |
| Component: | Layout and Rendering | Assignee: | JC Alvarado <joncarlo> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, simon.fraser, webkit-bug-importer, zalan |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
JC Alvarado
rdar://107953410
Testcase:
=======
<style>
track:checked,*:scope,.class2+#x33 { open;text-align: center;-webkit-ruby-position: }
.class3,#x24,*:read-only { }
#x31:not(form),*:last-child { visible;column-span: all;-webkit-padding-start: 0.44;font-variant: normal;hyphens: alpha;border-style: double }
*:empty { -0s;position: sticky;mask-size: }
.class3:not(#x55) { }
#x55,*:nth-child(even) { normal;list-style: url(data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAABgCAIAAABt+uBvAAAAAXNSR0IArs4c6QAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9wDGhYvCNVA1EIAAAAZdEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIEdJTVBXgQ4XAAAAjklEQVR42u3QIQEAMAgAsHNNVspTgARY1BZh0ZWP3VcgSJAgQYIECRKEIEGCBAkSJEgQggQJEiRIkCBBCBIkSJAgQYIECUKQIEGCBAkSJAhBggQJEiRIkCAECRIkSJAgQYIEIUiQIEGCBAkShCBBggQJEiRIEIIECRIkSJAgQYIQJEiQIEGCBAlCkCBBdwaeugIthHvZ+AAAAABJRU5ErkJggg==) disclosure-closed;outline: auto rgb(250,129,67);font-size-adjust: 0;transition-property: auto;-webkit-column-width: 288px;background-image: }
</style>
<script>
function gc() {
for(var i=0;i<100;i++) {
}
}
function main() {
try { x58.toBlob(f1,"image/jpeg",1); } catch { }
try { x2.replaceWith("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } catch { }
}
function f0() {
try { } catch { }
try { document.execCommand("justifyLeft",false,null); } catch { }
try { x58.addEventListener("DOMSubtreeModified",f3); } catch { }
try { document.execCommand("indent",false,null); } catch { }
try { x44.setAttribute("class","class1"); } catch { }
try { document.execCommand("justifyRight",false,null); } catch { }
try { document.execCommand("insertOrderedList",false,null); } catch { }
try { v73 } catch { }
try { } catch { }
}
function f1() {
try { document.designMode = "on"; } catch { }
try { x32.addEventListener("DOMSubtreeModified",f0); } catch { }
try { window.find("AA"); } catch { }
try { document.execCommand("insertText",false,"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); } catch { }
try { x19.click(); } catch { }
try { x58.width = 1; } catch { }
}
function f3() {
try { x32.append(x69); } catch { }
try { v17 = window.document; } catch { }
try { document.execCommand("justifyFull",false,null); } catch { }
try { } catch { }
try { v17.execCommand("insertOrderedList",false,null); } catch { }
try { v17.execCommand("createLink",false,"x"); } catch { }
}
</script>
<body onload="main()">
<span sticky">
</span>
<dir slot="foo">
</dir>
AAAAAAAAAAAAAAA
<blockquote onclick="f3()" hidden="" id="x19" space-between">
<blockquote itemid="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA">
</blockquote>
<canvas id="x58" spellcheck="false">
</canvas>
<samp id="x32" onfocusout="f4()">
<dialog id="x44" itemid="AA">
</blockquote>
<object accesskey="">
<track id="x69" contenteditable="false" spellcheck="false">
</dialog>
</progress>
</marquee>
</dialog>
<img contextmenu="x54">
<dl id="x2" webkitdropzone="move">
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
JC Alvarado
Pull request: https://github.com/WebKit/WebKit/pull/13172
EWS
Committed 263501@main (25d4c61111c5): <https://commits.webkit.org/263501@main>
Reviewed commits have been landed. Closing PR #13172 and removing active labels.